bf7c97e16b5207be12ba124e14c3a949d0282ce96a2016ef3d87be113f19e976

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
Size 4.9MB
Sample260701-sr6c6aaz2w
SHA256 bf7c97e16b5207be12ba124e14c3a949d0282ce96a2016ef3d87be113f19e976
MD5 5fd66917d5732054e306fb0cef089de5
SHA1 a8355f064b06910374b995d1178f0de72e920f14
SHA512 235d63fb68df3669845058ec31f4efa0c0c013f1ae5439e1b4b0faac09563fb4327cd762db3ecca5e0c051197e76e878e098b2f1cdd9a0499c04b6f3f8084ba1
SSDEEP 98304:tR7A8EhyctkzDFv5/ZBefVAQZEC2U7H3PrqWn53Rr/Ssclg5p87cD527BWG:tR0dtkRRByEY73Ln53Rr/S8pKcVQBWG
TLSH
T157362334D2452C37F2768A3845EEBE61BA38F409E332D3577729051A9EE27E8177A341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3456	elevation_service.exe
6028	elevation_service.exe
1592	maintenanceservice.exe
704	OSE.EXE
3404	PerceptionSimulationService.exe
2948	perfhost.exe
2316	ReFsDedupSvc.exe
3736	SensorDataService.exe
3448	ssh-agent.exe
2576	AgentService.exe
5804	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d23356ac4a0960ed.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114578\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e075bbf6d09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5f5f77f6d09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000065d49d806d09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000026efa3806d09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000917f2e826d09dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3456	elevation_service.exe
3456	elevation_service.exe
3456	elevation_service.exe
3456	elevation_service.exe
3456	elevation_service.exe
3456	elevation_service.exe
3456	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe
6028	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6108	2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
Token: SeBackupPrivilege	2316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2316	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2576	AgentService.exe
Token: 33	5804	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5804	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5804	SearchIndexer.exe
Token: SeDebugPrivilege	3456	elevation_service.exe
Token: SeDebugPrivilege	6028	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 5784	5804	SearchIndexer.exe	99
PID 5804 wrote to memory of 2292	5804	SearchIndexer.exe	100
PID 5804 wrote to memory of 6044	5804	SearchIndexer.exe	101
PID 5804 wrote to memory of 5924	5804	SearchIndexer.exe	102
PID 5804 wrote to memory of 760	5804	SearchIndexer.exe	104
PID 5804 wrote to memory of 5360	5804	SearchIndexer.exe	105
PID 5804 wrote to memory of 2120	5804	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_5fd66917d5732054e306fb0cef089de5_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1592

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:704

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2948

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3736

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1880 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:760
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1880 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f656036e63877d2323fe8550fcea6c58e85b14a6488fd1dbae84c9f95853efa4
MD5 9deb585ff67bcd137cf1e36b41782814
SHA1 188e3db581719cbc1f92a43994f7349d3dcec72d
SHA512 ed57474a159e38553d948611347dd964b1c6e6373293c90ac5e74cc63d71ddd8bb2fda82b590f4ed9c93d1c9e116bdd0d6d2afada066724a38959798a87f5018
SSDEEP 49152:Pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnbDmg27RnWGj:N3q6sjBsD527BWG
TLSH
T12BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 bafbe97bd9a1d7d48ef92359a7dae40ffece1b452e43abbf5bdfb2b6072f26bd
MD5 f9d4b342e731f41696416870e302399f
SHA1 028301c0a38073a0027fb8acec9106b4ea3e52b7
SHA512 1b28682868916d87f63530f02f187eab55bc3292de2f855bd3514299e3c7bf54a18b7d86182e7f5cb956bce633b4e2fa038212dafa0bb4169c8950efc41ace9c
SSDEEP 24576:gXYfDtczAUsqjnhMgeiCl7G0nehbGZpbD:XtcZDmg27RnWGj
TLSH
T1D4650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f6c098d33eae1788ac5bfdfe0f795ff3e1e6f2d3aea2d44792ef46dfb0a6fcc1
MD5 d4ce3e62ebd52af8bb57b7211eae367b
SHA1 127ef16c58eeccba9719afa6ba3fdb30ec2b691d
SHA512 3ffb83b303f5d298e0871417bb590ef1f27853f153e710a0858b4f8809231fc91edec104423cd189eb09ae7d033736d432477cf4ff65023c4910bad98e2c1708
SSDEEP 24576:Z0Le5ji0hmxxrM/sqjnhMgeiCl7G0nehbGZpbD:ZPji0AjiDmg27RnWGj
TLSH
T1FA859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8bdaeacf9e6347dc717a642d3d581ee33f48c6a3879015e0e5d6ace5dd425f44
MD5 64f5dfb9324210580de713ecf91b5a6f
SHA1 a86ede2d758fa2eb2c904c4d81f50483a4ebd39a
SHA512 6f5d1dac08eca3c99124262f46b7c2476bd5a8adc72603c658c1a3e0e195f69dad301d6602771fe919190692e62ea900e78980cde05f5a1c85a04dfac46a60eb
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWn6q8wyu1sqjnhMgeiCl7G0nehbGZpbD:J/ezSC6vUzPveHjyWDmg27RnWGj
TLSH
T18C755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1d11974a6522fe87bcd1381de2b7a31fdce8620d13e2f5c18897f96014615163
MD5 99933194f2f203d46ff1e181925cd463
SHA1 bb65c6d2acce321628fc0538b27650b2fddcd1de
SHA512 f7740a05a836f08ccc366b06d836d275e99b58b0fc520f8770dd4dc0a38f0d6f5a271676d7aae8633e7bd7d617c9251933d87df99732661b0506b947f08fc53d
SSDEEP 24576:KVbqPb88hv/l+YAsqjnhMgeiCl7G0nehbGZpbD:KVO88hXl+hDmg27RnWGj
TLSH
T170559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f8631c0ab6fc3c5320923bd0c0230fba022e6820bb9b31a629bf81a7faaca7bf
MD5 457e0a69ee88ca5e011d34613ddaee32
SHA1 3beee861fbf6e59ea75c0d5f0766554dc4cba6e6
SHA512 5b9ceece50423ab16ccf33faecca148f7904a18870183b4992b97d0d7582a54c97021c33ab21158ca817414470e15a014e8bce7b5c6a78f1768f6b53d9a95c9c
SSDEEP 12288:3LbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3LbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B4523BF874C50CAEA7608B5C3E9F11EAC137E56982008536AA37DFDE5B5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9adc201a2fc86162c86d422b317219fe987d4db9b087a547760e2523e072bc19
MD5 01d1b36a4c12240b59882f0ea8df61e4
SHA1 c07cc7630b6d7c5077e3ff54c3180701b497f8ae
SHA512 e2073d4a874f709cf2f0d32184573b26e04a79f5247cfd1053f0cad91a401de9968f630e3a1621464ab91872ee93fd344cabd11dd6267b35254572ee5b71c4aa
SSDEEP 12288:UeBNUbTVO86UYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:UJIUYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11465CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0392f022cd8526e1ddc50f326be0e57e04f297a31028cc8006bfa63b8d613150
MD5 98d4705729f13522b85a18b4dd32cea0
SHA1 d4b5c1634e0a3108e1b81e5977b88925c7b625e6
SHA512 1fc85057a40311be0a149ee602624eec35c1d10797988d3a1acbb93be22f9a03d57fea400a97ec32ee706ba19a65c01dd66d8c255711964fe1e34f9983394504
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THn:nQvGAdlCEL8c/DRNw5C5D527BWG
TLSH
T199266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4913a7ebf51f4a08ab93ec35437c4bf02f3527eb5af5ae7d9094b706e1fac3bc
MD5 69f31ff37ef7b1b5a333037f647695f5
SHA1 599e658b7b31615754899510b6cfb8f9502b8dbf
SHA512 9ede00ab245f653bc58f6e5a3b936d55d1f31c3e1aee9f2e79bd7e2fd5d56b646ad3ca6de5ec305b4d2021ce002d22aa15d4082927369add1c08e904d1bd55c3
SSDEEP 12288:fAwSfxL/2Dc3RDLLmt0LDQewsAjeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:o0ewsAjesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E675E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2e608355a6098c79eafcf9541f7097b7ba1de90c094925e1f9f8343bd78947be
MD5 8023dc10f94fa732fa2163d842335e29
SHA1 c1b3fc36f5f8e4b7a69ece9a381a6077df2a915f
SHA512 9218506e774d70cb95b7dc5c6d9f977eb77715a96a6f91a4c6acdee7e2b79256e47bd6ca8a28b3ff6ba42e186b2ef7fdfa2930536f62977afcf63da6c3084daf
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHqVQBWG:JUEtQevvqc2W1cpV2tI329B
TLSH
T194474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2953fd04547b375d2d6812298ec625ebaf68306ad0798695f661433fabdcf4b9
MD5 ac516da7da516f86c5e5d7f43aaadc19
SHA1 f7b029bdb8f5ca520d7c6db7ff93b45509504c62
SHA512 0500c029b3b9468ac048ffe65d2c17887d66c0da3e5928e615a3dd4d5062a7753210f0997010be6c43876f5106451e384fbfc3fa722f042c1f44d4f9e96f4da2
SSDEEP 49152:/CbRquA/m2yL5zTfFiV+XenmE3/zSDmg27RnWGj:YoquVjnmtD527BWG
TLSH
T1FFD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3d0a737354b904ffff9dd4896cb00c372fd82f9d3bec0ad84fb0ea22925ea298
MD5 9a560a22c992d4de6dd7f64db17e0f0e
SHA1 9945f4311ceb3f767d5f477accc266eede5c373a
SHA512 3c6a327324a3f17e1b7d7cbdbc38bc45cda5d70a7ce03f73cdaba47ec5375c9e07f1931ca8e2987599ca0492d4e9f15cf1890c5a0352bef0105a102368368d79
SSDEEP 24576:1AhGL3IFoiwtA5l7S53JsqjnhMgeiCl7G0nehbGZpbD:1AMUFoiq59Dmg27RnWGj
TLSH
T1A6359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 411558d7cc241a59c80dfaf7679aa8f1a58c60ebe6e85d02c6372fdb4adf9a8e
MD5 cef23d9494c43580bdfc1cec87261702
SHA1 1edc3c0714466884b87c90f3c7d64f503bd4fe34
SHA512 f60572e416a3a9f4f90db641e9aa414d6871c3af9a3f792cf314f0d77839cc0276238bbcabbd88f4f3aa89b6e43197046bd7ca4ea8be083857e7c15dcbac35bd
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+CVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Owu4OWysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC65F15A72A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6354d48656b37c753975caae7315dec55b261baae80774393a0b861ed798b145
MD5 9016b86b551536a13689365994acd98e
SHA1 01f9fe54f4f996006a3e43a842760b7091e48322
SHA512 46720e04ebad763aa963bb5e6085ddf06c0a4f90b4c792d93baf1a69becb0467e75a4074dfcf3ccf133ceae13cd4da121621a8f264195d2a60ec2ef07e696791
SSDEEP 12288:weZ1IyuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RZuXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1255512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 49bef73777eb3d86ada610f7a071aeb81d2c9df8613648a0ba314e7379192784
MD5 7ac8732b39b28b0ff0aed2d21d3e2a2e
SHA1 a378ccff0b7f27ed29eebc330bf7c476c8ae0a21
SHA512 aa4bc37cd3dc2704d4bda17a056d16480de566c64864292fc1f276752cd143eb8bd1fc3013d2880fb1267321464f77b02f6dd526feeb89db5853a3491fb6a1a3
SSDEEP 98304:9QRQyi36YOcPbLvw2gAf+PN3YD527BWG:0QyiKa/X+PNIVQBWG
TLSH
T160667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 acaba63e2896252d67642e6afbe92e6d312bae9809b97b83ef558c7167bb4ee4
MD5 e29f8502e172ec7e05c0130a26a1e311
SHA1 d0b59d9964780484ad942a1694b7cbf9b0dbb9eb
SHA512 f180092e03c2139af67c7516ce1a974906e1fb4241afc99afb3e0eac491589b88385e01807415a79fc8c134446a782ee3bbb1cd3cda2edc5292843454502ae47
SSDEEP 98304:+QRQyi36YOcPbLvw2gAf+PN3YD527BWG:lQyiKa/X+PNIVQBWG
TLSH
T130667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5c60534927b1be87caaf9d0f91d71628069d9a8bd3d6555aefb64bad933555b6
MD5 9466c030cfc0fd6b98e93492a170e1e4
SHA1 96d1baaa08e864c6d0a4a9934249d4445e3ed167
SHA512 9c078ce0910deaea4aa9f484133d7ab47671ff852454799de62fa8e2dfc14db1830b6dedda93b7c1ab0cab399fbc6f737facd79e5be13d8539c791cf583dcc6f
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0HsqjnhMgeiCl7Ge:f68Qg55nhceWu7PNU3/iDmg27RnWGj
TLSH
T19BB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d57293b283b1a89868410861457ab1fc74f8e921146dc1d119d3d4d80eaf09d9
MD5 2d6a7897594cc686b6b3a64b0c261049
SHA1 42e260759ce967cf2905a0608bade570345e1cef
SHA512 a8993e675ea8c55367f7689f3944a9a1faff7e75f0acc455f96dc61ea82eb8ec48f76e56476ea3b88b085ea409c54e9006a4f2019e65cbb9e7f8eadc8aff6319
SSDEEP 98304:jy5112gYy5azzVvt69nLKnhZPD527BWG:+LIHEWhlVQBWG
TLSH
T1B2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bbfd8b26efb2b0c086ae55c0606bee3a8d532a5a21ed9dbc44ce505b9e303e5c
MD5 3e20b01b7f07850a8047aa2a07666b3b
SHA1 46fab50c80146229ef44ca0680255dd84c950928
SHA512 d9e94203bfb5cbcb1b524f0f0f8829ff2db93a9525b01036eb5c58d67be9fa2ab7889f3555cb90f85242e9de902c8f2c0704479c99faa6188fa62b69f659db3c
SSDEEP 49152:jB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glgDmg27RnWGj:Vu6Jmdxd2dgD527BWG
TLSH
T16ED59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 83c50b28f38a21ccdd243f5ea543c19530ffdf2fe871c0daddcb706504b22322
MD5 adf545358d8055ea12b0f84de19b42fd
SHA1 3023773a14b753b48e66f6bb7d7160429a597020
SHA512 0836f16c2a9d16a934a98a7c32bdcaf649be83cc623a0150f1a9057cbf56dd09f940ccff493e1c88bb1356ff7ee3438fe1488a8ab2184bdf4ede547343c69acd
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xkDmg27RnWGj:9mifPWRtD527BWG
TLSH
T148B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8f11c8f543025768019dea48127d3531853767bbcff0852beb967068fdc8044e
MD5 cf57b8597b94c5d9058ecfb90ebe8dc5
SHA1 f80b8d85f197cad42c33dc8ee22cf7cde778cbce
SHA512 b85f5d850ade21c8a4bbfb3531cf230bd4bfe745bda62eb8ee816c91fd6bbac21b0eeb3251c49854b6dffad18d7d4be1a8e5024db144ca4b872e125b7c122c8c
SSDEEP 49152:USuZQIY0Be2KcRVtOnks6NMHqrDmg27RnWGj:G5dKii61rD527BWG
TLSH
T1F3C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 74ae9983ef5039b9cd58b3b65a22062784b21a9e2d25eb942c7270731113945f
MD5 f40f41f700f9682b544c2c76dbfcf966
SHA1 03c11af084babf72e210db61b454342e2d72894f
SHA512 bb7de329ae882ae413f6bb5435d94cf15d38e2ffff9db1759714d2f326664890308653ee70f292286541bb4fb30cf3a026a9e4631c3c79f743b4ba02ab36e880
SSDEEP 49152:FhtSn8EApI0fig3giDn0AP5wwDmg27RnWGj:0X2imphxD527BWG
TLSH
T11895BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 92fa2b2dd3aebda8b5fc0dae3139d06556b9c229c6e855951a6d689ef5ea86a4
MD5 8116e54dcb20d366736860854a28b18d
SHA1 d67172c83e17b717effa15dd83f5d66c847f2389
SHA512 96bdb4cde2db73dd91619fa11b0096ff84f626fcb618359a699c814c37090b05ef69f5c491b6906aed64c3ea7814ef98f406e96bf85aefdeff268b732be60126
SSDEEP 12288:/zXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/zsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1984523BF964C41CAE52648B5C3E9F14DAC073E5BE92004937A5B7CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ccfe4f705c65c84bcdd6481fe00c787213f9e67266a9c86ebd3f2f0e3b817e41
MD5 8a971093bae4fcd0f59bba62ab490e9e
SHA1 06cf00d1e71eef3e7f7ab72fc42ca336622a4cc7
SHA512 5f4bfeaca07ce0e198d6b5160ec1fa37dace7831bc6ca16e950b54037c9b323a74372294d308cc89599af5b156a1b32aacebf1c051e342a8c735fb3388f64999
SSDEEP 12288:qaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1284523BF965C41CAE52648B5C3E9F14DAC073E5BE92004837A9B7CBAF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b7ba07f320e34510d63cf071e2043b7cfaf01dd38548b388eef5fea8dbf9dfb5
MD5 295c241f9822453f2dd141b2661d59a6
SHA1 60259b1f84942b6c361cdc2845f0b4481b3abe9e
SHA512 8cc5afb7a749c4b6793d3c7ca1439b2b6f06df8139fd30ad705186eef84c0af393e98764f7f5a95a3bbd3e147fe202cf86679bc326418df3a23e2a78f0f01385
SSDEEP 12288:WwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BE965C41CAE52608B5C3E9F14DAC073E5BE92004837A9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 257a5f5e4a11358356dc003b1367a031342f22479ab2bf5dc16b4b711ebbc97f
MD5 820ccd297e7b7e60aad31a8ea8392263
SHA1 a9742b1c2ddc2e756e95009f4a768e958b90a823
SHA512 199932fca72e1c579708822de7ffd8e471c60b2453544d90fafd25308e7688efb6877baa9052928db4b767e6983c5ffdf711e7e5b91661e7b59f85e94a274d3b
SSDEEP 12288:jVpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11945237B575C00CAD87685B4C2F5E10DE8237D96EB3005DB6B532CAD9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0b0ba3ec37f7c487c36d98f829e3671ab005f825c046c78d6389e2d640d82e6c
MD5 ac3189ef6c81a1f1db234eee2c8cb534
SHA1 368d1130536a9882851d6664ef0317e33628d9b8
SHA512 ecb200528715ca961a6ec3ffda378e4b58264bd83bd60ef831d16f16ec2df4c16c77f5948f097942880a928a799996f6f6fbe4eebb7c0d565332cecd4691668c
SSDEEP 12288:BxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbEq:BxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B4523BE965C41CAE52608B5C3E9F14DAC073E5BE92004937A9B7CBDFBB14584B3C422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 389a4e0581f2f57fba452da5831680552b536965bdcdcc61966031aa431acdd3
MD5 1e5564546c62d2d520859d805c0b1369
SHA1 0001f24927eaa2a54b2fb1ccbc745133f36a0b4e
SHA512 55075a4ee1141f70c665c56289d72096792e866fe4be200c102bba94209ed417ffc29f5f4fdfdb8ce1a3d7f27218f6c7b463b94f55a30ac607156b0da07fab92
SSDEEP 12288:O2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:O2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BE964C41CAE52648B5C3E5F14DAC073E6BE92004937A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7aac905574e5cd0f0e25bcb8453bb4b17c2566ef40eafacadefcbe383c0ceac5
MD5 780b4e5e5364068393e0c2c508c1fdf2
SHA1 eecf1dbf8c39d2a19e7b5f1c1aa12e67dc9986f7
SHA512 46ec6656e791fff5481f2e355a93f953edeb0894dfb30a9ea9f118b5fcb1b1829ab6f34922b0eeca06aaa0d3ec066435d40866972e67679695b164445c4c37a7
SSDEEP 12288:SiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1084523BE965C41CAE52644B5C3E9F14DAC073E6BE92004837A5B7CBDF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 74acdb7bbaef1dbe6501756bb7839bfbaf25c8a1d6ca8391671e79092b7615f2
MD5 85d342cbd69384f29f3d9d8e7dba5694
SHA1 d820a68870be6ed8607cb37221ef672a6fd98ba8
SHA512 9044985ab7d275f79ae4a161478cc409b48fdd77b508fd2e958be9bc0087c14df883f8422bb652c08e87eebc7b3b6e44f11f152ee7daf6ad6aaed00b0f212740
SSDEEP 24576:jZMRzFVSO6sqjnhMgeiCl7G0nehbGZpbD:jZMRzfKDmg27RnWGj
TLSH
T1206501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4068afaca80e7219f95df0df043a6b1f98c2aa18ca91e2cd331cb82cd9bf47b4
MD5 0a12b06ca68c2c25491c46b2ba6dc659
SHA1 12ced27d564f982e003d7b7d57698b04322e2836
SHA512 f54f5950040dac5e1baacf6d9e8417c69fc8023349e172e31bb6a9c84ba40a60eaa3705f92d6061d7825094d3de66e4275c079b0987bda236d6bcc263d2d53fc
SSDEEP 12288:BnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BF965C51CAE52608B5C3E9F14DAC073E5BE92004837A9B7CBDFAB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 db575dd56c87964a06eed3f55cee651c68ef5148a686fe474e157e59288d864d
MD5 8e090dc93a4c3ad897c24170c340a956
SHA1 4c0c057f9c3ee62c0cef786ca0f651d3377837bb
SHA512 add4c59db5ea8dd3e1955a585b5c13c63b7772c63edfdeb97cd2b573aaa21261e8c0c09212bb2cb807cb416c0759b3e81393ab7c68f78ac048cb5eb1d0ad0800
SSDEEP 12288:mrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB4523BF965C41CAE92644B5C3E9F14DAC073E6BE92004837A5B7CBDF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 fa9ddbc7ab2474c88345e9e3481bc41ea416a76fe3c417c1dd39069efa3e088b
MD5 57ac5be38f1109ceec9238d785049e26
SHA1 e1aac072ded660c3406471b13560e29808ce0b28
SHA512 4d3a20cb22c5ef4f12ed6e6950fa6f06f74bf56e90e32a811f7e6884d8c8697563c1c9494a5692605c88bb0c9e8bc1ff5ab7edbd5fa0faa8078b222993bf133d
SSDEEP 12288:TyPz5L8uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ezyusqjnhMgeiCl7G0nehbGZpbD
TLSH
T15455125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3653758b4bd3d9df3a7314dda842fddc9a5e189e76bf99b52043514ce489368c
MD5 abb8b6a59737f8f98ec53370dcf874e8
SHA1 db0dfee971b9fb4514fa44c1b57a472694ddd51d
SHA512 fa5a78da9d70aec2453df966c2b7965ba2c8595ea8bdf69ab3d97aa5f7a549403e2745393f742ec0d27ea016483766dd5ea7b7513bce8a6456d3be0f2177bb2e
SSDEEP 12288:nnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BF965C51CAE52608B5C3E9F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d7f5130e60d1e75bebcbce094541990975dba5f1ad271a3628215fc64d20ee5d
MD5 e80d8d3404b867ea63fb39f54a9e611c
SHA1 74046b0f5a8646ffe26a653871557c229d392d38
SHA512 9c83c4dcd6c6141d6ecd41d1d10ab8d4316b918163ae1c12f5c2fb3c75de2cddc78c38ab2a0cdb17b0809b59ed640031cc1c35f602af7c6d0dcd6d682572fa26
SSDEEP 12288:XnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BF965C51CAE52608B5C3E9F14DAC073E5BE92004837A9B7CBDFAB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 04e8385b3525b5f3e76eaf3d36541e7258b4574355f95181169b45b17ceb0676
MD5 6f8b90f75d33d8cdf0e748beed21e188
SHA1 42e17559896a8856530e45df1180de1f41f2329e
SHA512 50e7fc08f8a8a61a86a06ac5a5e3b2e615432bf51e1498a4406ce6d4029757a26843072d45b7acaa9462b4591515cc4806248bc3dacaf955c9de0519ff9082b6
SSDEEP 12288:dyPz5L8uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzyusqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B55125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e71a05e7e43cff50b958230dceb0249ef7e597ded789a006d980ab56739bba26
MD5 a7497ff2441be854b0a7365b8f7d2b4d
SHA1 8689bfae27610b33042676ba6d8bab4b2b2730df
SHA512 07d9507a4bcd0047ac1328ca3665859b596ecbeb9b65c18448acf01b0b3bcfaca16c7d54e7b83d23cbd654c5e375c82b6626c64b80f03ee6c52b6fbc0b742788
SSDEEP 24576:dTDaLl3z0zDgsqjnhMgeiCl7G0nehbGZpbD:dTuLljpDmg27RnWGj
TLSH
T1DF6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 057ee26e35e76ce4024bfdbed13e7beccbd8a687225aa85df2e683885aa3ce81
MD5 3b34c3e639f772ff4aada17ba16ac686
SHA1 27096c1f9630eada463cd98feff39b99879e6a64
SHA512 19115fb75beaacb4325312e7985b09d015bad441f3bd771b45ebfb316107189aa7955a63db6d300de03cf7e4b60a351540cabaa6ab5f659b6149845ba9afc2d3
SSDEEP 24576:+3vd9CHKy7GZMsqjnhMgeiCl7G0nehbGZpbD:Avd9CHKyaKDmg27RnWGj
TLSH
T19975CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 1ca710d1938c02a487b5bff3a3209eb607f6038eefb66eb63091a81bee36156a
MD5 3889158cf524e43c929a0f58789550bb
SHA1 4480a974410a422523ed2c993eae7da0d4d538d2
SHA512 843318a4872bbcd9da14a0fe0bc64077df3d06e16bd80ffdec094e06f99f9bdff7e156e1679968b9bc97e1e334d0e783eb605580f6f1d754eb0183c40807591e
SSDEEP 12288:ZQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BE965C41CAE52508B5C3E9F14DAC073E6BE92004937A9B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c76bfed56ed2f2450f65e9b6e8e2318b4efd528a5e11acad6912254421cf4ed3
MD5 f769a32366e29c6561ca160dbf9d74da
SHA1 7bbc2449482077edae6225bdd4c2594182a87bfa
SHA512 6ff603cf5c13078a6c393880efe7fdb29ad9a5c13ac30224851ef8892a664848d8f055194c46d2e0c61e024ba62a8983db225bab99511d48dade54df41795449
SSDEEP 12288:xOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE4523BE965C41CAE52644F5C3E9E10DAC073E5BE92004937B977CBDEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 db0b38c98e624d80edf65a4217ef11eddb548f0e6d65e0801ff4cefc74453f95
MD5 848cdbf77a93e10099c3a2fa92fd4b76
SHA1 741565e2ead43885ac9d57d51e04ae2187a00034
SHA512 6b96393aec52e2a8e8dc4afe7e54fa0549bb74647c2aae9475ad042b1d07f053023f7aa56178ed62938f1372a982d0d2f55b4c2b9fec2d9520ed836c1899926c
SSDEEP 12288:HdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BF965C41CAE52548B5C3E9F14DAC073E5BE92004837A9B7CBDFAB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fa8083e51bf29eed82eebabb36bddcfd1bd146c3a99464175bff0d727abffa4d
MD5 65b3bc6b5fb22e9cd489fe1831b2742a
SHA1 cd7c87bcf490301e2892b034a7f1c90eb91cfcc4
SHA512 91af2657c0e5e153d3dee4512d2b90f705fca124467be0290d17b3f32b57dc730a2c4ca34ba4a140ce72935459b824a19e5b7e0d30a5dcff8aebc19f5035e7af
SSDEEP 12288:XnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D4523BF965C51CAE52608B5C3E9F14DAC073E5BE92004837A9B7CBDFAB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a5eb3557050fe2bc095ccd33a043dd0fa9edb0de856d223d3b30fae15c8062b7
MD5 8d49e0f7ae6fdfaddb3b810f078cbd39
SHA1 dcaea0d2dc203020fcac692c399cecc73ad4ccc2
SHA512 7c52541be7e6094970bb2084e4d74a2b471037353f83db0588800a202dd98755e006f4a8885291b602daefee8b073a2d661f178a5a6deffac42f8095fd43e31f
SSDEEP 12288:jQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BF965C41CAE52608B5C3E9F14DAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 04b2f49d372d99c96bda9174dfe1c6f485015f164b3c18935447e0438a9521f8
MD5 7e1abea254d90b166199581d1da02ec5
SHA1 c5bfc31260e9095a22351b89f23f43b167dc8880
SHA512 fabe561659a17caa05785888e82d70d13cfb81caa662ebd9ab04fcda3cf56042f65926f8c5eac42fd2545069ae919f706db11708bfb72120496e70ac410075d2
SSDEEP 12288:YvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A4523BE965C41CAE52648F5C3E9F10DAC073E6BE92004937A5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c86baa5d88aa2aee4d98c21b0f2b13ceff3647188c1dbf21eff9ef25b3650145
MD5 184b46f31cb7c742d3fab41b75c4858e
SHA1 c4de41e688c7c0eb2f70e0dbe03c3673dab03e48
SHA512 f8449b94d05b7c75c1218cacfe61571fcbd7c33dbf5de98cfcb6bfa91a037e82b2501a3ec23aaab9dd9e8b037b575c02cd90374df6a357f5571bfa940b69af06
SSDEEP 12288:JxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F94523BE965C41CAE52648B5C3E5F14DAC073E6BE92004837A9B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 8a171082f226169d3b22144e8d20615e14e596920f61c0896785b41f77a2e2d5
MD5 6be5dd9b13c0647e351b780f640fe04b
SHA1 d3cd75f09c53dc3fa841f154ab2ff50beebcacc3
SHA512 c9c8e98bba519c1de0464482497a8b8fc146204ba987b451a6891de82e0d8ad45dfb3ce6b85d33dfc4122e867c4ac7275e742ed794b231a727691778b0110bd6
SSDEEP 12288:2oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BE965C41CAE52648F5C3E9E14DAC073E6BE92004837B5B7CBDEBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 14071d9ecc953c5fd0206e0c2cade7bf4e9ed3f64621762821a8ea1274fb55f6
MD5 41992735f4e5bc23717cfeb0cd0ec324
SHA1 591abe9e556cc90110d3e79bed57ce179b15804b
SHA512 f20b6acd04a7297b4d7a3ed9d6b90755990c96e4c111f945bf892eb46d792f5ffdb2d0b22efad40c0f6d593b450fbb7ca981ce0869261946fbaa826a96572186
SSDEEP 12288:LxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA4523BF965C41CAE52508B5C3E9F14DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ea2d76dcb92814e3000dc6197e10e0e15377c4d5ebf307012b328782ded5a54a
MD5 3c136e4938e423c901fa676884c7334b
SHA1 ac290b8a8e20907017b5b7c5245a422d93445280
SHA512 6b8cfba2683530816a0a943c3f81b8d2d1c05b88d74fce5fbd5e3ee5c8c71c2ff3421d0e880c4f8011ff474281e565e41eb3811811718c927a8ca05e8e85a02a
SSDEEP 24576:kfwvUk9RX6wkyAI7sqjnhMgeiCl7G0nehbGZpbD:gMnYIvDmg27RnWGj
TLSH
T15685D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6bc57de368697f1b669d52de60052930aa3252bcc93059f79d24e54d28a740d4
MD5 567e29f2205485cd8d188cf40cb86afa
SHA1 14a195e4b8ccc22d4e9b807ef162008b37d515ba
SHA512 82a2a712b698c0a67ba7edf979072b14179c644f91b11cc9c66a91379c776557f83df163e6559e18bfb061c7bb8a3254e82d1064443f45c599c55269b5134bf3
SSDEEP 49152:4YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QDmg27RnWGj:vySzP4D527BWG
TLSH
T173066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 48fcdbafe9151de43acc56c3abfd4a9090393acb7fdc0166ffc55d4be8d74373
MD5 c0743dc01248cb8c9b116024d832cbe1
SHA1 e5b3fccaa86cb7686e182cb891d97082c2af7af8
SHA512 ba56143d7660c7b4a6558afe5b29e2852ba15883f5e71c103810938e58b215ea51309c4b3022f7a6508b740ddf90975db12f3467e9b8019b6ae8b1d9e45336fe
SSDEEP 24576:147Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYKsqjnhMgeiCl7G0nehbGZpbD:147JUQjTirIhCnDHUPfF/gDmg27RnWGj
TLSH
T1F965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 30eabe85194b5d6b3f5fe00abb95601b125ed89ed04a1e563dd61e1b7be9a90a
MD5 e7643765110b181d66e6cd65b568abbd
SHA1 837d4f41fd101c4c44824b7e11993ec619805c62
SHA512 8f4792023c5c802e24e625ab3fff3b7bb835cc11d6df541dbc5c24527b6004832a6f35872470bed7e0fc48eb54d63396f2cff7e1f2349dc8196b56db7a0c73f8
SSDEEP 12288:dbsfXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4XsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E855015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 cc680864e75a7bb1c942167a3031a52b16f999426b2549e15e8e3c9f3f8704e9
MD5 bc98f71627e794d3a1391ea38120521c
SHA1 1d68aa3f50554f68492370accf7c69b5d4186271
SHA512 85fd621de576393552c34be1e643724ca8c9e6257021cba40bc5cc5b8880eb09009d00babf54066d1ec6f84f4b6ea88a6c15be2ca08a6d64532c16a28bc406af
SSDEEP 12288:5uFmllU3f/VrpnnNIzWjNf9lGYAvT48tDvrcL/ocWnzPettod:5GAlUP//nnNI6g5MgvIjKnzPC6
TLSH
T198352801B666D74FC66D40321E33C6CCAB707D41EE45AB0772C98B2FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 35597c93a374debee900909f7dda0c279ccb32724e0353f5a76e24a396d02caf
MD5 0853284c899fad1af7fcf274987619db
SHA1 e0f978153965fb010e7159fbb88d43906b2921e2
SHA512 9d8a486c274c33b27227c6c9aad6357f153a66c99d9dec0f1b5dc87fcb954132c89a6cd8128571d8447c75bd9412bc109b6aba340c7a5b99a9df74c5c4d5e09f
SSDEEP 6144:oSgu3qB8YjIxuoNdkdhsKIy5jI6IN2Vf5v1RjTf5JGUj4qFLW87MxvYixtMx4niz:3E8YUEXIbwssWtW
TLSH
T1A965E840D137A28FD1F7607207295B8DABA4EC477B056F26B3C8057AD82BB15A1BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c16755d702d65e82844866ea606d9c62c350d4f69e4efc758367af38e43abcde
MD5 454919cf9048b93fe8bfa5c6ecee6933
SHA1 2649c3270698824252a86027c84129adff866879
SHA512 9f31b93fe9c0cea91b08b092fbf1c5c49f097c109e10a4f46d52d422bd25502ce396cb03daee51de8549074e3f67969a1258fac4748f29e8b77aefcbde7beaa0
SSDEEP 12288:W07fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C745237B935C518AE83605B482EEE12D680B7E669F1044C3BA4778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cb42865c125e30d7052a2f3115e36ff47aff63210f5d24d992ff929027b89756
MD5 77eb7406bc6c846d7397e37ce5e09c7d
SHA1 5ce9a314e31331c58f2c92d69787b1dcbdd135fe
SHA512 c0ee9fbbc09f2b9d2f4f175286b013056c9d4136c4afa0ef12c0e60bd696ba9a44e3dfe0d4e312be955ed0aa5430caee19d5154c61e12aa8a5dbf58d5e4f5225
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bY1sqjnhMgeiCl7G0nehbGZpbD:ngb4mBIBhGFeDmg27RnWGj
TLSH
T189659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d7f333b2a6db811144e760d57536d76f6ee8b32c5be9d42039d312ec57f3e51b
MD5 d00d245cec4304af51e849c62ac1e89c
SHA1 1e3e1a643e9ca23783a7062b22d73858aa183d86
SHA512 7b647edbb1215b53e275a429ea8a93a3506db82374b84c6e786d5b9e7aff78bc05da205f33714685384d41b1d5e09db3cb423aba498c069a367a77f5dadce76b
SSDEEP 24576:zG88u8FpJqH1bzria7/m6sqjnhMgeiCl7G0nehbGZpbD:C7ZFPqVea7/hDmg27RnWGj
TLSH
T16C85016577E401F1D47BD138CA868667F5B2B8250360EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 249b81dbbd797376ffe8eb8406c67ac962a10fb37cfc84b1ab90c689a42c2e23
MD5 1bdf030e6bcd984ecea6b38b44d1038d
SHA1 ebf6d2c23ba0d89fa02b9228be8bf8f7f6dd21fa
SHA512 65fb53423028de146b2a29bd34fbdef2cd91ba0a25709045bdc4a41c4732349d8d8771ddf71721e727daaf96abf7d52c33d96468dcb02021025170f4de08b5bd
SSDEEP 12288:DHvUrBFrEjwaQGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:DPUr+NQGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F165F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ccc6b004a8d13ab3221e7947481ce527a0bc0ddaa6cbb1660b71526999e56a15
MD5 ca87b2710ace67a139377747b54906b8
SHA1 0a87a6ae55ca29bdd2133a8dd16a40e3fcfc6ec5
SHA512 8ce3cbe5f2ec401f2c3103799e12b932c1cdf6bb3bf6c07da3e6db1345235f695ddfe41788bdef192a0cf2c4706526f96b0fe6aa53aeb909c3ba93440bec586e
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6Dmg27RnWGj:FG05lO43bHD527BWG
TLSH
T118D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 50acb0a3dc19f609b5009e13dcc713a849c5e92e3c59f15cfb0fd12d21519705
MD5 6d382534bf1a42007a74fae31c27514b
SHA1 c71657a62507dd8d68fe20cee08b24a9b506b256
SHA512 e18e26ca6e805e771e2b62489bae4db5f0d0f27f4b482ee4d2543fc8d0dfac0247f2b0855b0a7252b5f957e5b493cdb69b922085d1c9728809ab49ec630ebc36
SSDEEP 24576:lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn0sqjnhMgeiCl7G0nehbGZpbD:la5POZ3BJt2pasx2+miDmg27RnWGj
TLSH
T16C65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fb2febd8f48859173388ff368bfc207cc79c007622fcf4d41732f53e87d98a79
MD5 fc3071a1acb3acb1b3fc6fa221b73f79
SHA1 968014d169b5862fc366fd81bd8efb8941cad654
SHA512 516f3e93061b5e366f20d97f0f5dfd2210f7aef03bc100da621215190ef08e02613c56f2a6338904d41e25676ceaaa348f0a776afe2eab753042d04538be4185
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkSsqjnhMgeiCl7G0nehbGZpbD:3Nc/zEOVHFBDmg27RnWGj
TLSH
T127857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3f8415638e6bef34cfefcb6f08dc12014dae5a805e387431dcfc3278a956e607
MD5 7d8b46cf07b5ecb1c49dc975066f85d4
SHA1 f53cfe41bf50186348599989d08bb7e155800386
SHA512 3d6a3ae1475e5dd735fc89422ffe0725c211b702a20f5b3b094378c1759d52a0c30d1ed1bd04bdcafe6c31824dc42e9e7019d4ecd2338ba4269b0742fc6acac9
SSDEEP 24576:uTkNvNnaFeYhJNtmZBmosqjnhMgeiCl7G0nehbGZpbD:uTMwBtOmUDmg27RnWGj
TLSH
T11355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9e887be4fb0bd2598360792456ba89f5e341f8974eb9a756375a841a98c0c61e
MD5 436ef6524aa335ad83c5da5bf6b04735
SHA1 3f9ff508566676e045fe9992bb2d61d74b89bb66
SHA512 658261fb247ac012aaac10405baf94b76387219832f952ec3813b4750d46b9dd2535930aa2f574ff47620e4dd045624206fcedc37398b43f5703cd003c19bfd0
SSDEEP 24576:ND3FHshBIYQgATsqjnhMgeiCl7G0nehbGZpbD:NDVHeBIAAXDmg27RnWGj
TLSH
T1EF75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/704-199-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/704-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/704-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1592-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1592-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1592-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1592-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1592-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2316-81-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2316-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2316-87-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2316-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2316-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2316-373-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2576-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2576-119-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2576-127-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2576-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2576-125-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2948-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3404-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3404-66-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3404-72-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3404-237-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3448-113-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3448-346-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3448-106-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3448-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3456-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3456-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3456-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3456-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3456-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3736-325-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/3736-93-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3736-99-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3736-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3736-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3736-329-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/3736-326-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5804-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5804-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5804-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5804-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5924-370-0x000001E1B2D60000-0x000001E1B2E91000-memory.dmp

Download

memory/6028-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6028-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6028-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6028-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6028-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/6044-369-0x0000027D73270000-0x0000027D732B2000-memory.dmp

Download

memory/6044-399-0x0000027D73270000-0x0000027D732B2000-memory.dmp

Download

memory/6108-0-0x0000000000400000-0x00000000008FE000-memory.dmp

Download

memory/6108-1-0x0000000000CD0000-0x0000000000D37000-memory.dmp

Download

memory/6108-6-0x0000000000CD0000-0x0000000000D37000-memory.dmp

Download

memory/6108-7-0x0000000000CD0000-0x0000000000D37000-memory.dmp

Download

memory/6108-250-0x0000000000400000-0x00000000008FE000-memory.dmp

Download

memory/6108-76-0x0000000000400000-0x00000000008FE000-memory.dmp

Download